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ABSTRACT 



The alarm manager display in a distributed network man- 
agement system is arranged to have two modes of operation. 
In one mode of operation, the alarm manager display auto- 
matically scrolls when new events arrive. If there are sorting 
criteria defined, the alarm manager window scrolls either up 
or down depending on the sort order so that when new 
events arrive, they always appear on the screen. In the 
second mode of operation, the alarm manager window does 
not scroll when new events arrive. The scroll bar operational 
modes are selectable by an operator from a menu. In 
accordance with another embodiment, a special attribute is 
added to the alarm manager configuration file. This attribute 
is read when the alarm manager is started and places the 
alarm manager into the operational mode in which it was last 
used. 

13 Claims, 9 Drawing Sheets 
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ALARM MANAGER SYSTEM FOR 
DISTRIBUTED NETWORK MANAGEMENT 
SYSTEM 

FIELD OF THE INVENTION 5 

This invention relates to network management tools for 
managing distributed networks and, in particular, to alarm 
management and alarm servicing tools. 

BACKGROUND OF THE INVENTION 10 

Present day telecommunications and information net- 
works have become larger and far more complex than those 
which have been available only a few years ago. The trend 
towards increases in size and complexity can be expected to 
continue at a high rate into the foreseeable future with the 15 
proliferation of cellular networks, the development and 
deployment of global satellite networks, and the expansion 
of basic wireline networks in developing nations. Both 
homogeneous and heterogeneous networks are now being 
connected together by means of the Internet and other 20 
inter-network connection mechanisms. 

In order to maintain network reliability and an acceptable 
quality of service, it is necessary to carefully monitor and 
manage network resources. However, as existing networks 25 
grow larger and more complex, network management also 
becomes more difficult and more complex. The prior art 
responded by providing automated management tools for 
reporting network status. These tools allowed network man- 
agement personnel to improve the quality of service and 3Q 
maintain high network availability and reliability. 

Such automated management tools were distributed and 
generally arranged as client server applications which pro- 
vided integrated for supporting heterogeneous network envi- 
ronments. The client portion of the tools was arranged to 35 
have a standard interface which minimized variations of 
look and feel of the system as seen by the network opera- 
tions personnel whereas the server portion was designed to 
operate on different platforms. The distributed architecture 
allowed the tool to evolve and scale as the networks evolved 40 
in size, capabilities, and geographies. 

One such distributed network management tool is the 
Solstice Enterprise Manager™ (Solstice EM) network man- 
agement system which was developed and is marketed by 
Sun Microsystems, Inc. This tool has an object-oriented and 45 
distributed architecture which consists of a plurality of 
cooperating components, including applications, libraries, 
information services, databases, and protocols, each of 
which performs specific tasks. The managed resources are 
arranged as a plurality of interconnected nodes and "man- 50 
agement agents" running in each node gather information 
about the resources associated with the node. The informa- 
tion is then forwarded back to a management information 
server (MIS) which interacts with management applications 
running in other nodes. The MIS can request and change 55 
management parameter values, perform requested actions, 
and receive and evaluate problem reports (e.g. events, such 
as SNMP traps and CMIP notifications) that the manage- 
ment agents generate. 

Although the MIS and the management agents can com- 60 
municate with each other via various network management 
protocols such as Simple Network Management Protocol 
(SNMP), Common Management Information Protocol 
(CMIP), or other proprietary/legacy protocols, the Solstice 
EM™ framework interposes software model representations 65 
of managed resources in the MIS between management 
applications and agents of managed resources. The result is 
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that the management applications need not be concerned 
with management protocol dependencies of the managed 
resources since the applications only interact with the soft- 
ware model representations in the MIS. 

In particular, the management applications direct man- 
agement tasks in the MIS via a "Portable Management 
Interface (PMI)" which is a high-level abstraction of an 
interface for manipulating objects, regardless of their class 
description, supported protocol, or location. The PMI is also 
used by the MIS to communicate with the management 
agents. For example, the MIS can use a management pro- 
tocol adapter (MPA) to communicate with a management 
agent. An MPA translates MIS requests to protocol-specific 
primitives (e.g. CMIP, SNMP, RPC, or other proprietary/ 
legacy protocol primitives) depending upon the manage- 
ment agent in question. For example, a CMIP MPA com- 
municates with CMIP agents. 

One of the most important tasks that a network manager 
can perform is "alarm" monitoring and management. An 
alarm is an unsolicited notification called a "trap" in SNMP 
terminology and an "event" in CMIP terminology which is 
generated by an agent and sent to the MIS. The notification 
generally indicates that a particular managed resource asso- 
ciated with the agent has experienced a fault or failure 
condition or otherwise requires attention. Alarms have an 
associated severity level which can range from "critical" to 
"warning." Network management personnel can manage the 
alarms by changing their state. For example, a newly gen- 
erated alarm has an "open" state. Network management 
personnel can "acknowledge" the alarm indicating that the 
alarm has been noted. After investigating the problem, the 
alarm can be "cleared", indicating the problem has been 
corrected. 

Alarm Services is a module in the Solstice EM 7M MIS 
responsible for updating and storing the state of managed 
objects in the MIS. Alarms arrive at the MIS as event 
notifications (via an MPA, for example). When such an 
event is received by the MIS, it is stored in an alarm log as 
an alarm log record by a Logging Services module and the 
Alarm Services module is informed about the arrival of this 
alarm. The Alarm Services module maps each managed- 
object-based alarm to a corresponding node in a topology 
database (discussed below) and updates the alarm counters 
for that topology node based on the alarm severity. The 
Alarm Services module also keeps the severity synchronized 
so that it represents the highest (most critical) uncleared 
alarm log record that is posted against the topology node. 
The node status is propagated to applications like the 
Solstice EM™ Viewer and displayed in the appropriate 
color. The alarm information is also sent to the Solstice 
EM™ Alarm Manager application for display. 

The Alarm Manager program is intended to be used by 
network administrators and operators, to allow them to 
quickly see problems in the enterprise, and give them access 
to enough information so the problem can be fixed. The 
Alarm Manager does not display the alarm notifications 
directly. Instead it displays the alarm log records in the alarm 
log database in a tabular format. Therefore, the Alarm 
Manager has filters which can discard unwanted alarm 
information and can summarize, sort, and prioritize alarm 
information in order to display the information in a manner 
which is most information to the network management 
personnel. The Alarm manager also monitors the alarm log 
for events such as object creation, object deletion and object 
attribute values changes so that its display can be updated in 
an appropriate manner. Further, the Alarm manager can 
change the state of an alarm. For example, network person- 
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nel can use the Alarm Manager to change the state of an FIG. 1 is a block schematic diagram of a distributed 

alarm from "open" to "acknowledged" or "cleared." This network management system on which the present invention 

can be accomplished by selecting a particular alarm on a can be operated. 

display screen and invoking an option to change the alarm FIG. 2 is a block schematic diagram of a Solstice EM™ 

slate - 5 distributed network management system on which the 

The Alarm Manager typically displays log records as rows present invention can be operated, 

in a record table. When the alarm log has many records, the FIG. 3 is a block schematic diagram illustrating the 

large number of rows will not fit on the screen. communication between the user-developed management 

Consequently, a scroll bar is provided to allow a user to application and the MIS of the Solstice EM™ distributed 

scroll the records up and down on the screen so that a desired 10 network management systemi 

record can be brought into view. When new records are , . . , , , ,. 

added to the display, the scroll bar typically flickers and FIG - 4 15 a , block S * 6 ^ c f 8 ""™^" 8 -u^ 

resizes to alter the user that new records have arrived. Semoe f °P eratl0Q ™ ^ the distrtbuted 

. , . , , . _ network management system. 

However, there are problems with this arrangement. In . 

particular, the flickering and resizing of the scroll bar is not 15 FIG 5 15 a bl ° ck schematic illustration of the contents of 

sufficiently noticeable to signal network management per- a conventional alarm log database. 

sonnel that new events have arrived. Even if an operator is FIG. 6 is a screen display of the alarm manager illustrat- 

viewing the display when new events arrive, it is very easy m g an a l arm summary display. 

to miss the resizing and thus miss very critical events. FIG. 7 is a screen display of the alarm manager illustrat- 

In addition, if an operator actually wants to see all of the 20 ing display of individual alarms, 

incoming events as they arrive, the operator must continu- FIG. 8 is a screen display illustrating a view property 

ally click on the scroll bar as events come in. In a busy dialog box with scrolling selections in accordance with the 

system, it is impossible to click fast enough to see all events. principles of the invention. 

Further, it is difficult to accurately move the scroll bar An FIG. 9 is a flowchart illustrating the steps performed by a 

operator can click on the scroll bar arrow button to scroll the " scro n m g function, 
events, but the arrow only scrolls down the display one event 

at a time and thus is slow. It would be more advantageous DETAILED DESCRIPTION OF THE 

to click on the slider between the scroll bar thumb and the PREFERRED EMBODIMENT 

arrow, but if the log is large enough, this area is so small that „ T - . . L1 , 

it is nearly impossible to keep clicking in it accurately. 30 FIG ' 1 15 a block dia S ram °* a ^nbuted network 
~ t , . f * ! n .™. , management system on which an illustrative inventive net- 
Consequently, some versions of the Solstice EM™ system , , . * _* J J' i 
. 7 u- u • i j . work management system constructed according to the 
used an alarm manager in which incoming alarms caused the . . J * . iL ° 

, it * *• 11 tt • u * present invention can run. As shown, the system is a 

display to scroll automatically. However, in such systems . ., t , .. . t ' . . 7 . c 

+L r ' c » ii- ,v n- • distributed computing environment comprising a plurality of 

there was no way of controlling the scrolling since it was . , r . to , ^ AO .A/-, J , 

. . r : * i u*u j* i i _j 35 individual computer nodes 108, 112, 120 and 124. The nodes 

inherent in the list control which displayed the alarm records c t . „ . , . , , . , , 

r, , iv i j . « are functionally organized into device nodes 112, 120 and 

Further, in such systems, scrolluig always occurred in the A ~ A , . . ~ , 1AO . t \ , 

tt „ t tT j ,r * j -, 124 and at least one manager node 108 interconnected over 

up direction. However, depending on sort order, alarms . , 11A TT r , , + 

, , . ' , r , * , tU \ j jr a network 110. However, the device nodes 112, 120 and 124 
could appear at either the top or bottom of the control. If * m „„ n „_ ine _ ' K ■ , f J . , 
i j * *u u ** c*u * Li u and manager 10s can also be implemented on a single 
alarms appeared at the bottom of the table a user would not , , ™ , T . x . & 
u ui f *u i u ii ii j iL , ui 40 computer system. The manager node 108, is a convention- 
be able to see them unless he manually scrolled the table « , , , 6 . , . . , 
j t , JV . i . *u * * . ally programmed digital computer which mcludes user inter- 
down. In addition, in large systems, the constant movement C ' J > U -tAft 1 i 1 ^rt- 

* tU a- i a '* Am u * i i a facing devices, such as a monitor 100, keyboard 102 and 

oi the display screen made it difficult to acknowledge 8 1A . T ' , - ... J t , • 

• j • • j * i & mouse 104. In the described embodiment, each node 108 is 

individual alarms. , . . , 4 , ' „ „ 

a network connectable computer, such as a Sun SparcSta- 

SUMMARY OF THE INVENTION 45 tion™5 workstation running the Solaris™ operating system, 
The aforementioned drawbacks are addressed in one a version of the UNIX® operating system, or an IBM- 
illustrative embodiment of the invention in which the alarm compatible computer running the Windows NT™ operating 
manager display is arranged to have two modes of operation. system. However, use of the systems and processes 
In one mode of operation, the alarm manager display auto- described and suggested herein are not limited to a particular 
matically scrolls when new events arrive. If there are sorting 50 computer configuration. SparcStation™ and Solaris™ are 
criteria defined, the alarm manager window scrolls either up trademarks of Sun Microsystems, Inc., Mountain View, 
or down depending on the sort order so that when new Calif. UNIX® is a registered trademark of The Open Group, 
events arrive, they always appear on the screen. In the Cambridge, Mass. Windows NT™ is a trademark of 
second mode of operation, the alarm manager window does Microsoft Corporation, Redmond, Wash. The manager node 
not scroll when new events arrive. 55 108 also includes a database 106, such as a relational 
In accordance with one embodiment of the invention, the database > Ale system or other organized data storage system 
scroll bar operational modes are selectable by an operator whlch stores management information m a management 
from a menu. In accordance with another embodiment, a ^formation database or MIB. 

special attribute name is added to the alarm manager con- ^ Java programming language is rapidly emerging as 

figuration file. This attribute is read when the alarm manager 60 thc preferred object-oriented programming (OOP) language 

is started and places the alarm manager into the operational for cross pl^form use because Java programs consist of 

mode in which it was last used. bytecodes, which are architecture and operating system 

nnrr ^„ ™ _ independent and can be sent over the Internet and other 

BRIEF DESCRIPTION OF THE DRAWINGS n6tworks . ^ bytecode fa actually execu|ed on a partiaJar 

The above and further advantages of the invention may be 65 platform by means of a "virtual machine" (VM) which 

better understood by referring to the following description in allows a Java program to be run on any platform, regardless 

conjunction with the accompanying drawings in which: of whether the Java program was developed on, or for, the 
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particular platform which attempts to run the Java program. communicate with SunNet manager (SNM) agents 218 by 
Java bytecodes which arrive at the executing machine are means of an SNM protocol adapter 212. In a like manner, 
interpreted and executed by the embedded VM. A complete management information server 208 can communicate with 
Java program is known as an application, while a segment CMIP agents 220 by means of a CMIP protocol adapter 214. 
of Java code, which does not amount to a full application, 5 The configuration illustrated in FIG. 2 allows separate 
but is reusable, is referred to as an "applet* \ management applications, such as applications 200, 204 and 
Since Java is well-suited to operation on various 206, to share information and operate with a remote database 
platforms, the following description of the illustrative localed ^ "ie management information server 208. Man- 
embodiment is directed toward the Java programming lan- a ^. ment ^maUon server 208 can, m turn communicate 
tt ■* u • * *u 1*11 * • . in with a number of local or remote agents 216, 218, and 220 
guaee. However, it will be obvious to those skilled in the art 1° • , r ...^ . & r" 7 . * 
f L . u i_ • 1 * j f ,-^r> over various network facilities including the internet by 

hn la\Tls welf e° C++ im P lemented for other 00P means of several different protocols. 

an ^ * a ' e "^' ' FIG. 3 illustrates, in a more detailed fashion, the manner 

Each device node, 112, 120 and 124, corresponds to a in which user-developed management application 300 corn- 
managed device which might for example, be a processor, municates with the MIS server 306. In particular, the user- 
printer, storage device, network adapter card or other net- developed management application 300 which is located in 
work apparatus. The state of each managed device is moni- the c ii ent node 308 communicates with the management 
tored and controlled by an agent program running in the information server 306 located in the server node 310 by 
node. For example, agent programs 114, 118 and 128 run in mcans of a portable management interface (PMI) 302. The 
nodes 112, 120 and 124, respectively. Each agent may also portable management interface is an object-oriented inter- 
have a local management information database (116, 122 face whicn prov ides a consistent object-oriented access to 
and 126, respectively) which stores status information and the management information. It supports distributed appli- 
parameters for the managed device. cations that use various management protocols and address 

In operation, a management application program running transparency. It utilizes a small number of C++ classes and 

in the manager node 108 cooperates with the agents 114, 118 25 allows for both asynchronous and synchronous applications, 

and 128 to manage the network. Th6 manager 108 can event registration for an application and various develop - 

download information from the 'agents 114, 118 and 128 or ment services, such as runtime type checking, 

from their associated databases 116, 122 and 126. The The portable management interface 302 connects to the 

manager node 108 can also set parameters in the devices by management information server 306 by means of a commu- 

instructing the agent programs to set parameters and values 3Q nication protocol indicated schematically as box 304. This 

within the devices or their drivers. protocol allows the portable management interface to access 

In the distributed network management system illustrated managed object instance state information stored or man- 
in FIG. 1, a single management node 108 is illustrated. This aged by the information server 306. It also allows access to 
type of system is satisfactory for small networks. However, managed object class schema stored by the management 
it does not scale easily because it is difficult to add additional 35 information server 306 and access to the event services 
management nodes as the network grows larger. FIG. 2 provided by the management information server The por- 
illustrates a distributed network management system which table management interface 302 also allows managed object 
is designed to be scaleable by using a centralized manage- instance data to be cached in an application process and 
ment information server (MIS) 208. Management informa- provides a simplified syntax for managed objects instance 
tion server 208 can provide management information to a 4Q naming. 

number of management applications operating in separate Events are handled in this system by a callback function 

computers 200, 204 and 206, respectively. Alternatively, the registration procedure in -which a user-developed manage - 

management application may operate in one or more com- menhapplication, which' desires to obtain noti ficatio n_of an 

puter systems. A system based on this architecture is the even^which occurs in one of the devices, registers with the 

Solstice Enterprise Manager™ network management system 45 management information server 306 (by means of the por- 

which is available from Sun Microsystems, Inc., 901 San table management interface 302) an interest in the particular 

Antonio Road, Palo Alto, Calif. The remainder of the event. The application then acts as a "listener" for the event, 

application will be described in the context of the Solstice When the event occurs, the management information server 

EM™ system. However, it will be obvious to those skilled 306 calls all* of the interested listeners. An object in the 

in the art that similar network management systems could be 50 portable management interface 302 then handles the event 

used with the inventive management system without depart- call by' forwarding it' to the user-developed management 

ing from the spirit and scope of the invention. In this system, application 300. 

the management applications are able to access management FIG. 4 illustrates, in a schematic form, the processing of 

information located in the management information data- network alarms by a conventional Solstice EM™ network 

base that is now sited in the management information server 55 management system. In particular, agents connected to nct- 

208. work 416 generate events or traps (generically referred to as 

The management information server 208 interacts with "network alarms") in response -to conditions which occur in 

the agents associated with the managed objects 216, 218 and the resources with 1 which they are associated. The network 

220, respectively. These agents are typically located alarms arrive at a management protocol adapter 414 which 

remotely in the device nodes and can communicate with the 60 processes the alarms and generates events that are provided 

management information server 208 by means of a variety to a logging services module 410. The logging services 

of protocols. In particular, management information server module 410 updates an alarm log database 412 by adding a 

208 can operate with separate protocols by means of man- record containing the alarm information. In particular, the 

agement protocol adapters 210, 212 and 214. For example, alarm log database 412 contains alarm log records as shown 

management information server 208 can communicate with 65 in FIG. 5. 

SNMP agents 216 by means of an SNMP protocol adapter FIG. 5 illustrates a portion of alarm log database 500 

210. Similarly, management information server 208 can which contains various alarm records, 502, 504, 506, 508, 
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510, 512, 514, 516 and 518. Generally, alarm records the status of network problems. Alarms may exist in three 

502-518 include information concerning the date (and time) possible states: open, acknowledged and cleared. An open 

of an alarm and the alarm source arid may additionally alarm has been received by the MIS and added to the alarm 

include other information helpful to network management log, but not yet acted upon by an operator. An acknowledged 

personnel in identifying the cause of the alarm and its S alarm has been seen by an operator who has marked it to 

solution. indicate that the alarm is being investigated. A cleared alarm 

In addition, logging services module 410 forwards the indicates that the problem which caused the alarm has been 

events to an alarm services module 406. The alarm services fixed. In the display window 600, an alarm may be marked 

module 406 is responsible for updating the state of a acknowledged or cleared, or both. An open alarm is neither 

corresponding node in the topology database 408. The alarm io acknowledged nor cleared. 

services module 406 also generates display commands In the association viewing mode, such as that illustrated 

which are provided to a viewer 400 and an alarm manager in FIG. 6, an alarm listed in the table of alarms actually 

402. For example, alarm services module 406, in response to represents a group of similar alarms. The alarm selected to 

an incoming alarm event, can issue a display command to represent the group is either the highest severity, or the most 

the viewer 400 causing the vie.wer to modify the display icon 15 recent. The operator can determine the criteria used to select 

associated with the resource. In response thereto, the viewer the representative alarm when he specifies the association 

400 can change the color or shape of the icon. In addition, rules. Any action taken on an alarm while viewing associa- 

the alarm services module' 406 can send another display tions applies to all the alarms in the group associated with 

command to the alarm manager 402 causing it to add another that alarm. For example, if an alarm is acknowledged in the 

line on its display representing the newly-received alarm 20 association viewing mode, all alarms in the same association 

event. are changed to an acknowledged state. 

In the conventional Solstice EM™ network management The alarms can also be filtered to select only those that 

system, the viewer 400 and the alarm manager 402 are match selected criteria. The criteria include managed object 

programs which would be located at the client terminal and instance or the device triggering the alarm; managed object 

manipulated by means. of the- portable managejnenHnter- 25 class or the type of device or resource generating alarms; 

face. The alarm manager displaVsa^raTnTtc^pr ^entatSn^ alarm state or severity and event type, such as 

_ alarms a nd is intended to be used b yjie^o*r^ToSirn^rator s communications, Internet, etc. Further filtering can be per- 

UnToperators, to allow tEeTrTnTquickly see problems in the formed on the date and time, acknowledgment operator or 

enterprtee^mti pive them access tQ'erj fMgh informftUinn the user name of the operator who acknowledged an alarm, 

the problem c an be ^fixgd. The alarm manager does not 30 acknowledgment date, clear operator or the user name of the 

display the alarms directly; instead it displays the records i n operator who cleared an alarm, clear date and problem code 

thj^fomtog . *i neretore, the alarms can be fi^^^^nd or the numeric or textual ID of the probable cause of an 

yumifiiiri!Zm*before being displayed on the screen . alarm. 

In particular, the graphic representation or view allows 35 The display window 600 also allows an operator to 

network personnel to View summary information about all change the view of alarms from the summary view shown in 

alarms or the details of an individual alarm. The alarms FIG. 6 to an alarm instance view shown in FIG. 7 by clicking 

manager display can also be used to change the state of an on the "Instances" button 608. In the alarm instances view 

alarm as work progresses on resolving problems that trigger window 700, each individual alarm is represented by a line 

an alarm. Alarms of a certain type can also be grouped into 4Q in the display. Additional information is also displayed for 

an association so that actions can be taken on the group as each alarm. This additional information includes the event 

a whole. As mentioned, the display can filter alarms to type, acknowledgment operator, acknowledgment date, 

further refine the type of alarms an operator may wish to clear operator, clear date and event details. The alarms can 

view. The display can further be used to delete alarms from also be sorted in either ascending or descending order on any 

the alarm log and graph alarm information ^ of the attributes. 

When the alarm manager is initially started it displays a One problem with the alarm instances window illustrated 

summary view of the alarms as indicated in FIG. 6. A in FIG. 7 is the scroll bar 704 which allows an operator to 

summary view is a view of an alarm association. Alarm scroll particular lmes representing individual alarms onto the 

associations are groupings of alarms with equivalent values display screen. When the alarm log has many records, the 

for one or more selected attributes, such as event type and 50 large number of rows will not fit on the screen display 700. 

object instance. Associations make it easier to manage large Consequently, the scroll bar 704 is provided to allow a user 

numbers of alarms generated for the same network problem, to scroll the records up and down on the screen so that a 

or problems in related areas. desired record can be brought into view. When new records 

This window display 600 is a conventional window 600 are added to the display, the scroll bar thumb 706 typically 

with a menu bar 602 that indicates several alarm attributes. 55 flickers and resizes to alter the user that new records have 

One attribute is "perceived severity." The perceived severity arrived. 

is an attribute of each alarm, indicating the seriousness of the However, the flickering and resizing of the scroll bar 
problem which caused the alarm. Each alarm is assigned one thumb 706 is not sufficiently noticeable to signal network 
of a predetermined number of severity levels, such as management personnel that new events have arrived. Even 
"critical", "major", "warning", "minor", "normal" and 60 if an operator is viewing the display when new events arrive, 
"indeterminate" Severity is indicated in the alarm summary it is very easy to miss the resizing and thus miss very critical 
window 600 by the Severity column 604 and by the color events. In addition, if an operator actually wants to see all of 
shown in the first column 606 in the window 600 wherein the incoming events as they arrive, the operator must con- 
different colors are used for each severity level. The view tinually click on the scroll bar 704 as events come in. In a 
illustrated in FIG. 6 shows an alarm association by severity. 6S busy system, it is impossible to click fast enough to see all 
The display window 600 also shows the "state" of alarms. events. Further, it is difficult to accurately move the scroll 
The state of an alarm helps network operators keep track of bar thumb 706. An operator can click on the scroll bar arrow 
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buttons 702, 708 to scroll the events, but the arrows 702, 708 The control 820 operates in conjunction with a scrolling 

only scroll down the display one event at a time and thus are function which controls the alarm instance display. FIG. 9 is 

slow to use. It would be more advantageous to click on the a flowchart illustrating the steps in such a function. The 

slider 710 between the scroll bar thumb 706 and the arrow process begins in step 900 and immediately proceeds to step 

708, but if the log is large enough, this area is so small that 5 902 where the function waits for an alarm to be received. If 

it is nearly impossible to keep clicking in it accurately. In no ncw a i arm is received, the process proceeds back to step 

addition, depending on a sort order, newly arrived alarms 902 t 0 wait for an alarm, 

can arrive at the top or bottom of the alarm list. In accor- ,, 71 _ . . *. , iL 

dance with the principles of the present invention, a scrolling ™ hcn a u n ^™ 15 received ' the P ro f ess to step 

function is inserted between the incoming alarm records and in 904 m which a determination is made whether the "No" 

the tabular display, such as display view window 700. In 10 °P Uon 1D contro1 820 has been selected. If so, the process 

addition a user interface is added to control the scrolling. finishes in step 912. 

The scrolling direction can be either "up" or "down", Alternatively, if, in step 904, the "Yes" option has been 

depending on the alarm sort order so user will always see the selected, the process proceeds to step 906 in which a 

latest incoming alarm. determination is made whether the sort order is ascending or 

The user interface is illustrated in FIG. 8 which shows the 15 descending, 

"view properties" dialog of the inventive system. This dialog if the sort order is ascending the display is scrolled up one 

would be launched by selecting the "View" menu option 712 line in step 910 Alternatively, if the sort order is descending 

in FIG. 7 and then the "properties" selection from the menu thc disp{ ^ y k down one ^ in step 90 8, l n either 

popup. The view properties window 800 illustrated in FIG. case the proce ss ends in step 912. 

8 allows a user to control various aspects of the alarm 20 A Ci , 4 r , j l j 

,. . „ 1 A i o . . i , , OA - , A software implementation of the above-described 

display. For example, the Summary option button 802 can be uj * • • r * ■ * *• 

, ^ ' t , ' o „ r u unkfP , • embodiment may comprise a series of computer instructions 

used to control the summary display. If the 'Off option is , c , J ^ r . , . ; 

, , j t c n , • ' -iiL j- 1 j T f iL either fixed on a tangible medium, such as a computer 

selected a list of all alarm instances will be displayed. If the , , , j- 1 n^x* 

it r\ » • 1 * j ■ t - n u 1 • 1 * #u readable media, e.g. a diskette, a CD-ROM, a ROM 

On option is selected associations will be displayed on the J ' . , , , ' 

, v j . 1 . , - AA v 3 75 memory, or a fixed disk, or transmissible to a computer 

alarm manager display window 700. LZ . , ,i_ ■ * *■ j * 

^ < £ o . ^ ^ u 0 «„ „ • system, via a modem or other interface device over a 

The "Summarize By> field 804 determines the way medium The medium can be eithef a ible 

groups of alarms are summarized in the a arm manager inc]udiDg; bm not limited to tical or anal ^^i^. 

window when the Summary On option is selected. Groups UoDS ^ Qf be im lemented with wireless techniques , 

of alarms can be listed in order of seventy or by object inc]uding hui not limited to microwaV e 7 i nfrar ed or other 

instance by selecting the appropriate option. transmission techniques. It may also be the Internet. The 

The "Show Duplicate Alarms" field 806 controls display series of computer instructions embodies all or part of the 
of duplicate alarms. When the "On" option is selected and functionality previously described herein with respect to the 
the Summary option On is selected, and Alarm Association invention. Those skilled in the art will appreciate that such 
is Off, the summary line includes a count of duplicate 3f . computer instructions can be written in a number of pro- 
alarms, gramming languages for use with many computer architec- 

The "Display Object Name as" field 808 determines tures or operating systems. Further, such instructions may be 

whether the system name or the Fully Distinguished Name sto red using any memory technology, present or future, 

(FDN) is displayed for the alarm device names. including, but not limited to, semiconductor, magnetic, 

The "Apply Alarm Color to" field 810 determines whether 4Q optical or other memory devices, or transmitted using any 
only the first column of an alarm row displays the alarm communications technology, present or future, including but 
color or the entire row. The "Display Attribute Name" field not limited to optical, infrared, microwave, or other trans- 
812 determines whether names labels in the table columns mission technologies. It is contemplated that such a corn- 
use the system default names or user-defined names. puter program product may be distributed as a removable 

The Hidden Attributes and Shown Attributes fields, 814 45 media with accompanying printed or electronic 

and 816, determine which alarm log attributes are displayed. documentation, e.g., shrink wrapped software, pre-loaded 

Any attribute can be moved from one field list to the other with a computer system, e.g., on system ROM or fixed disk, 

by selecting the item and clicking on the Show or Hide or distributed from a server or electronic bulletin board over 

buttons. The selected item moves from the original list to the a network, e.g., the Internet or World Wide Web. 

other list. 50 Although an exemplary embodiment of the invention has 

The Sort Order button 818 opens a sort order window (not been disclosed, it will be apparent to those skilled in the art 

shown) which determines the order— according to selected that various changes and modifications can be made which 

attributes^ — in which alarms are sorted in the alarm associa- will achieve some of the advantages of the invention without 

tions and alarm instances windows. departing from the spirit and scope of the invention. For 

In accordance with the principles of the invention, a new ss example, it will be obvious to those reasonably skilled in the 

control labeled "Scroll on Arrival of New Alarms:" 820 is art that, although the description was directed to a particular 

included. This control allows an operator to select whether hardware system and operating system, other hardware and 

the alarm instances window will automatically scroll when operating system software could be used in the same manner 

a new alarm record arrives or not. If the "yes" option is as that described. Other aspects, such as the specific instruc- 

selected, the alarm instances window will scroll when a new 60 tions utilized to achieve a particular function, as well as 

alarm record is received. If the "No" option is selected, the other modifications to the inventive concept are intended to 

alarm instances window will not scroll. In order to save the be covered by the appended claims, 

scrolling configuration a new attribute called "auto__scroll= What is claimed is: 

off" can be added to the configuration files which control the 1. Apparatus for use with a distributed network manage - 

startup configuration of the alarm manager view properties 65 ment system having alarm generation agents which generate 

window. This attribute holds the operator's selection in alarms indicating the status of devices in a network, an alarm 

control 820. log for receiving and storing the alarms and an alarm 
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manager which' displays the contents of the alarm log in a 
scrollable list wherein only a predetermined number of items 
on the list are displayed, the apparatus comprising: 

a user interface for receiving a command from a user of 
the alarm manager which command indicates whether 
the scrollable list should scroll in response to an alarm 
being received in the alarm log; and 
a scrolling function which is responsive to an alarm being 
received in the alarm log for adding the received alarm 
to the list and to the user command for controlling the 
scrollable list for switching between a first mode in 
which the list scrolls automatically in response to each 
received alarm so that the .most recent alarm is always 
displayed and a second mode in which the list does not 
scroll automatically in response to each received alarm 
so that each received alarm can be manually scrolled 
into view and selected from the list, but a selected 
alarm remains displayed as alarms are received. 

2. Apparatus according to claim 1 wherein the alarm 
manager comprises a mechanism for sorting the alarm 
records in an ascending sort order and in a descending sort 
order and wherein the scrolling function comprises a mecha- 
nism for scrolling the scrollable display in a first direction 
when the sort order is ascending and in a second direction 
when the sort order is descending. 

3. Apparatus according to claim 1 wherein the user 
interface comprises a control in a dialog box. 

4. Apparatus according to claim 3 wherein the dialog box 
is displayed in response to a menu option. 

5. Apparatus according to claim 3 wherein the control is 
an option button, 

6. Apparatus according to claim 5 further comprising a 
configuration file for determining the initial state of the 
option button. 

7. A method for use with a distributed network manage- 
ment system having alarm generation agents which generate 
alarms indicating the status of devices in a network, an alarm 
log for ' receiving and storing the alarms and an alarm 
manager which displays the contents of the alarm log in a 
scrollable list wherein only a predetermined number of items 
on the list are displayed, the method comprising the steps of: 

(a) receiving a command from a user of the alarm man- 
ager which command indicates whether the scrollable 
list should scroll in response to an alarm being received 
in the alarm log; and 

(b) controlling the scrollable list in response to an alarm 
being received in the alarm log to add the received 
alarm to the list and to the user command to switch 
between a first mode in which the list scrolls automati- 
cally in response to each received alarm so that the 
most recent alarm is always displayed and a second 
mode in which the list does not scroll automatically in 
response to each received alarm so that each received 
alarm can be manually scrolled into view and selected 
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from the list, but a selected alarm remains displayed as 
alarms are received. 

8. A method according to claim 7 wherein the alarm 
manager comprises a mechanism for sorting the alarm 
records in an ascending sort order and in a descending sort 
order and wherein step (b) comprises the step of: 

(bl) scrolling the scrollable display in a first direction 

when the sort order is ascending; and 
(b2) scrolling the scrollable display in a second direction 

when the sort order is descending. 

9. A method according to claim 7 wherein step (a) 
comprises the step of: 

(al) using a control in a dialog box to receive the user 
command. 

10. A method according to claim 9 wherein step (al) 
comprises the step of: 

(a la) displaying the dialog box in response to a menu 
option. 

11. A method according to claim 9 wherein step (al) 
comprises the step of: 

(alb) using an option button in a dialog box to receive the 
user command. 

12. A method according to claim 11 wherein step (a) 
further comprises the step of: 

(a2) using a configuration file for determining the initial 
state of the option button. 

13. A computer program product for use with a distributed 
network management system having alarm generation 
agents which generate alarms indicating the status of devices 
in a network, an alarm log for receiving and storing the 
alarms and an alarm manager which displays the contents of 
the alarm log in a scrollable list wherein only a predeter- 
mined number of items on the list are displayed, the com- 
puter program product comprising a computer usable 
medium having computer readable program code thereon, 
including: 

program code for receiving a command from a user of the 
alarm manager which command indicates whether the 
scrollable list should scroll in response to an alarm 
being received in the alarm log; and 

program code for controlling the scrollable list in 
response to an alarm being received in the alarm log to 
add the received alarm to the list and to the user 
command to switch between a first mode in which the 
list scrolls automatically in response to each received 
alarm so that the most recent alarm is always displayed 
and a second mode in which the list does not scroll 
automatically in response to each received alarm so that 
each received alarm can be manually scrolled into view 
and selected from the list, but a selected alarm remains 
displayed as alarms are received. 
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